elastic / elastic/integrations
Elastic Agent Azure Logs Integration missing related.users
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
Hello,
Just migrated from Filebeat azure module to Elastic Agent Azure Logs integration and I noticed some issues.
1) There seems to be no `related.users` field for the signin logs. THis is unfortunate, as this field is very usable to correlate data.
2) The user.name filed is populated correctly for the `SignInLogs `but not for the `ServicePrincipalSignInLogs`. The field containing the `ServicePrincipalSignInUser` is `azure.signinlogs.properties.service_principal_name`. The value of this field should be copied to `user.name` and to `related.users`
An example sanitized log:
```
{
"_index": ".ds-logs-azure.signinlogs-default-2024.02.13-000001",
"_id": "ojMQo40BDs_HQWCsjO44",
"_version": 1,
"_score": 0,
"_ignored": [
"event.original"
],
"_source": {
"agent": {
"name": "myagentnode",
"id": "",
"ephemeral_id": "",
"type": "filebeat",
"version": "8.11.4"
},
"log": {
"level": "4"
},
"elastic_agent": {
"id": "",
"version": "8.11.4",
"snapshot": false
},
"azure-eventhub": {
"sequence_number": 39194,
"consumer_group": "$Default",
"offset": 17183841952,
"eventhub": "signinlogs",
"enqueued_time": "2024-02-13T14:45:47.225Z"
},
"tags": [
"preserve_original_event",
"azure-signinlogs",
"forwarded"
],
"cloud": {
"provider": "azure"
},
"input": {
"type": "azure-eventhub"
},
"@timestamp": "2024-02-13T14:44:04.060Z",
"ecs": {
"version": "8.0.0"
},
"related": {
"ip": [
"33.44.55.66"
]
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.signinlogs"
},
"client": {
"ip": "33.44.55.66"
},
"event": {
"duration": 0,
"agent_id_status": "verified",
"ingested": "2024-02-13T15:23:07Z",
"kind": "event",
"action": "Sign-in activity",
"id": "event-id",
"category": [
"authentication"
],
"type": [
"info"
],
"dataset": "azure.signinlogs",
"outcome": "success"
},
"azure": {
"tenant_id": "tenant-id",
"signinlogs": {
"result_type": "0",
"operation_version": "1.0",
"caller_ip_address": "33.44.55.66",
"result_signature": "None",
"operation_name": "Sign-in activity",
"category": "ServicePrincipalSignInLogs",
"properties": {
"risk_level_aggregated": "low",
"is_tenant_restricted": false,
"applied_conditional_access_policies": [],
"created_at": "2024-02-13T14:42:31.738821+00:00",
"risk_level_during_signin": "low",
"authentication_protocol": "none",
"sign_in_token_protection_status": "none",
"resource_service_principal_id": "princip-id",
"token_issuer_type": "AzureAD",
"conditional_access_status": "notApplied",
"id": "event-id",
"client_credential_type": "none",
"app_id": "app-id",
"service_principal_credential_key_id": "cred-id",
"is_interactive": false,
"service_principal_id": "princip-id",
"flagged_for_review": false,
"authentication_processing_details": {
"Azure AD App Authentication Library": "Family: MSAL Library: MSAL.NET 4.8.2.0 Platform: .NET FW"
},
"risk_detail": "none",
"resource_display_name": "Microsoft Graph",
"risk_state": "none",
"incoming_token_type": "none",
"cross_tenant_access_type": "none",
"original_transfer_method": "none",
"processing_time_ms": 0,
"resource_id": "00000003-0000-0000-c000-000000000000",
"app_service_principal_id": null,
"correlation_id": "co-id",
"service_principal_name": "MyServicePrincipalUser",
"unique_token_identifier": "un-token",
"status": {
"error_code": 0
}
}
},
"resource": {
"provider": "Microsoft.aadiam",
"id": "/tenants/tenant-id/providers/Microsoft.aadiam"
},
"correlation_id": "co-id"
}
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.